mbedtls_pk_write_key_pem() does not work with secp256r1 keys (and tfm?)

[randomdude]

Hi,

I'm writing an app that creates a CSR, has it signed by a (web-)server and subsequently uses it to authenticate to another (mqtt-)server. For the CSR generation and signing part I am using mbedtls, while for the authentication I am writing the credentials to the modem. This only works if I use an externally generated key, because I was not able to export a locally generated key via mbedtls_pk_write_key_pem(), no matter what I tried. The function exits with error code 0xc680, which doesn't seem to be defined anywhere. Furthermore, I haven't been able to use the mbedtls_strerror() function. It looks like it is being built, but the linker cannot find it.

I understand that mbedtls integration with tfm is a work in progress, but I'm struggling to keep up, and I'm afraid I got lost somewhere along the way.

So, to wrap this up let me reiterate:

• What does mbedtls-error 0xc680 mean?
• What do I need to do to use mbedtls_pk_write_key_pem()?
• What do I need to do to use mbedtls_strerror()?

Thanks in advance!

[randomdude]

Hi,

let me cut right to your questions:

Sigurd Hellesvik said:

• Will you use the certificates for a TLS connection, for some custom purpose, or something else?
• Do you know if you want to use an offloaded socket or native socket?

The certificate (and private key) will be used to authenticate to our company's MQTT server, and I want to use offloaded sockets if possible. Actually I've already confirmed that part to work.

The problem is, that while I can access and write the signed certificate to a <Public Certificate> slot in the credentials storage, I haven't found a way to access the private key I generated in the very first step, to write it to corresponding the <Private Key> slot.

Sigurd Hellesvik said:

I would go for "it is hard".

Thanks for comforting me . I've been working with freeRTOS and the old nRF5 SDK for quite a while now, so I should know my way around these matters, but the switch to Zephyr caught me a bit off guard, I guess..

[Sigurd Hellesvik]

Hi,

In this case, I do not think you need to generate your keys in your application. You can make your modem generate them for you.

See Securely generating credentials on the nRF9160.

Regards,
Sigurd Hellesvik

[randomdude]

This might be exactly what I was missing. Although the instructions call for an external python script to convert the answer of the modem-KEYGEN command, the parser function in that script reveals that the first part of that answer actually is the CSR, already base64 encoded and ready to go. I'll just have to add the BEGIN/END lines, and I should be set.

I'll code that up and let you know how it works out.

[randomdude]

This actually works! But it seems a bit like a fluke that the function generates exactly the kind of key I need, and makes me wonder what would have been if I had needed any other type of key, like RSA or whatever. Although in that case my original approach could have worked.

But anyway, this will do for now (at least until the mbedtls key writing functions are fixed/fully implemented).

Thank you for your support and your patience!